CVE-2025-68542

Missing Authorization vulnerability in vgdevsolutions Checkout Gateway for IRIS checkout-gateway-iris allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Checkout Gateway for IRIS: from n/a through = 1.3...

Insecure Direct Object Reference (IDOR)

spreeapi is vulnerable to Insecure Direct Object Reference IDOR. The vulnerability is due to improper ownership validation in the guest checkout flow, which allows an attacker to manipulate address ID parameters and bind arbitrary guest addresses to their order...

CVE-2025-68542

Missing Authorization vulnerability in vgdevsolutions Checkout Gateway for IRIS checkout-gateway-iris allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Checkout Gateway for IRIS: from n/a through = 1.3...

CVE-2025-68542 WordPress Checkout Gateway for IRIS plugin <= 1.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in vgdevsolutions Checkout Gateway for IRIS checkout-gateway-iris allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Checkout Gateway for IRIS: from n/a through = 1.3...

CVE-2025-68542

CVE-2025-68542 describes a Missing Authorization/Broken Access Control vulnerability in vgdevsolutions Checkout Gateway for IRIS (WordPress plugin Checkout Gateway for IRIS) 1.3.

WordPress Checkout Field Manager (Checkout Manager) for WooCommerce plugin <= 7.8.1 - Unauthenticated Limited File Upload vulnerability

Unauthenticated Limited File Upload vulnerability discovered by Jamiryoo in WordPress Plugin WooCommerce Checkout Manager versions = 7.8.1...

CVE-2025-12500

The Checkout Field Manager Checkout Manager for WooCommerce plugin for WordPress is vulnerable to unauthenticated limited file upload in all versions up to, and including, 7.8.1. This is due to the plugin not properly verifying that a user is authorized to perform file upload actions via the...

CVE-2025-68542: Missing Authorization

Missing Authorization vulnerability in vgdevsolutions Checkout Gateway for IRIS checkout-gateway-iris allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Checkout Gateway for IRIS: from n/a through = 1.3...

WordPress plugin Checkout Gateway for IRIS 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be added to a...

PT-2026-21095

Name of the Vulnerable Software and Affected Versions vgdevsolutions Checkout Gateway for IRIS versions through 1.3 Description An authorization issue exists in vgdevsolutions Checkout Gateway for IRIS. The issue involves incorrectly configured access control security levels, potentially allowing...

WordPress Checkout Field Manager (Checkout Manager) for WooCommerce plugin <= 7.8.5 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary Attachment Deletion vulnerability discovered by NosleeP++ in WordPress Plugin WooCommerce Checkout Manager versions = 7.8.5...

CVE-2026-25419

Missing Authorization vulnerability in flycart UpsellWP checkout-upsell-and-order-bumps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UpsellWP: from n/a through = 2.2.5...

CVE-2026-25419 WordPress UpsellWP plugin <= 2.2.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in flycart UpsellWP checkout-upsell-and-order-bumps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UpsellWP: from n/a through = 2.2.3...

CVE-2026-25419

Missing Authorization vulnerability in flycart UpsellWP checkout-upsell-and-order-bumps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UpsellWP: from n/a through = 2.2.3...

CVE-2026-25419 WordPress UpsellWP plugin <= 2.2.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in flycart UpsellWP checkout-upsell-and-order-bumps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UpsellWP: from n/a through = 2.2.5...

CVE-2026-25419

CVE-2026-25419 is a Missing Authorization vulnerability described as Broken Access Control in the UpsellWP plugin (checkout-upsell-and-order-bumps). Affected software: UpsellWP for WordPress, version range from n/a through 2.2.5 (per initial doc); Red Hat entry and PatchStack reference reiterate ...

CVE-2025-13930

The Checkout Field Manager Checkout Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 7.8.5. This is due to the plugin not properly verifying that a user is authorized to delete an attachment combined with flawed guest order...

CVE-2025-12500

The Checkout Field Manager Checkout Manager for WooCommerce plugin for WordPress is vulnerable to unauthenticated limited file upload in all versions up to, and including, 7.8.1. This is due to the plugin not properly verifying that a user is authorized to perform file upload actions via the...

CVE-2025-13930 Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.8.5 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion

The Checkout Field Manager Checkout Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 7.8.5. This is due to the plugin not properly verifying that a user is authorized to delete an attachment combined with flawed guest order...

CVE-2025-13930

The CVE-2025-13930 entry concerns the Checkout Field Manager (Checkout Manager) for WooCommerce plugin on WordPress. Affected versions are up to and including 7.8.5, where an authorization bypass allows unauthenticated attackers to delete attachments associated with guest orders. The root cause c...